The bank said the new online keypad, which replaces the old sign-in page, would tighten security for its 1.9 million Internet banking customers by removing the use of a keyboard to enter passwords.
Cybercriminals have devised ways of recording keystrokes entered on a Web page, and have in the past used this to capture online banking customers' passwords.
"The online keypad uses special technology to scramble Customer IDs and passwords and prevent those attempting fraud from capturing entered information," said Westpac head of channel and systems management, Paul Jennings.
Westpac claimed to be the first major bank to introduce the initiative, although keypads are already used by other industry players, such as ING.
Jennings said Westpac would continue to investigate further security initiatives for its online banking service.
While this may seem like a good idea from the perspective that compromised machines now have a small amount of added security. This one change has SERIOUSLY REDUCED ones ability to protect their password from anyone who might somehow see them login. There is no way to discretely or quickly type in your password with an onscreen keyboard, unless you are by yourself in a room with no windows.
It is also an unfortunate fact that it is just as easy to track mouse movements as it is key clicks, and there is source code freely available on the internet designed specifically to do it, so it won't be long before this new type of "protection" is easily compromised by those who would benefit from it.
If Westpac is serious about their customers security, what they should do is offer a choice of authentication options, including but not limited to the following:
a) Normal keyboard password entry
It works, and provided you acknowledge the risks it shouldn't be prevented.
b) Client Certificates
Many companies, including Telstra currently use these for client authentication. They are simple to use, secure and aren't subject to traditional password capture attacks.
c) A random or moving on screen keyboard
Much like what Westpac have done but securely.
The keys must either arrange themselves into a random configuration or it must move randomly after each click otherwise a "sniffer" could simply "play back" you mouse movements to determine your authentication details.
d) SecureId tokens.
Westpac already offer this facility for their Business Banking services when transferring large sums of money. It is very simple and when the token and pin a kept separately it is extremely secure. A small fee would no doubt need to be charged for the token itself but I would pay it.
e) Smartcards & Biometrics.
While these require extra hardware and are not very widespread they offer unique advantages in that like the SecurId tokens, when implemented correctly they require interaction with physical items that simply cannot be duplicated by "sniffing" and replaying a previous authentication session.
Unfortunately I think a lot of people are going to have to be burned by online criminals before we start to see any serious efforts into customer security being taken.